Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/01/2024, 08:25
Static task
static1
Behavioral task
behavioral1
Sample
PHOTO-DEVOCHKA.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
PHOTO-DEVOCHKA.exe
Resource
win10v2004-20231222-en
General
-
Target
PHOTO-DEVOCHKA.exe
-
Size
150KB
-
MD5
13064a1549e859958c07462c9b2f0a58
-
SHA1
da6a8be2da028023ad9a350845eae67a64b5bf7e
-
SHA256
dd8a4e021d917b7085788dcdf7d881c679a17416493fcf45ebbfedbed0df32ea
-
SHA512
f28a80bb53fbcb0aed10248a69e7dfbb93671d689d3df6f73eb57b6220348c25cfdb3c0cf2f791aedd44267dba4401d5c0392a2da3f460f25b3509260d2fe533
-
SSDEEP
3072:lBAp5XhKpN4eOyVTGfhEClj8jTk+0hirrmrtA8ujM1jo:AbXE9OiTGfhEClq9dmLsM1E
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 3 2624 WScript.exe 5 2624 WScript.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts WScript.exe File opened for modification C:\Windows\System32\drivers\etc\hîsts WScript.exe File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\dus_dezodorant\mouyus\tutunas.nistyak PHOTO-DEVOCHKA.exe File opened for modification C:\Program Files (x86)\dus_dezodorant\mouyus\zelands.bat PHOTO-DEVOCHKA.exe File opened for modification C:\Program Files (x86)\dus_dezodorant\mouyus\90909090.ico PHOTO-DEVOCHKA.exe File opened for modification C:\Program Files (x86)\dus_dezodorant\mouyus\readme.txt PHOTO-DEVOCHKA.exe File opened for modification C:\Program Files (x86)\dus_dezodorant\mouyus\fifa.vbs PHOTO-DEVOCHKA.exe File opened for modification C:\Program Files (x86)\dus_dezodorant\mouyus\drochka_peredrochka.vbs PHOTO-DEVOCHKA.exe File opened for modification C:\Program Files (x86)\dus_dezodorant\mouyus\Uninstall.exe PHOTO-DEVOCHKA.exe File created C:\Program Files (x86)\dus_dezodorant\mouyus\Uninstall.ini PHOTO-DEVOCHKA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2724 wrote to memory of 2664 2724 PHOTO-DEVOCHKA.exe 24 PID 2724 wrote to memory of 2664 2724 PHOTO-DEVOCHKA.exe 24 PID 2724 wrote to memory of 2664 2724 PHOTO-DEVOCHKA.exe 24 PID 2724 wrote to memory of 2664 2724 PHOTO-DEVOCHKA.exe 24 PID 2664 wrote to memory of 2624 2664 cmd.exe 30 PID 2664 wrote to memory of 2624 2664 cmd.exe 30 PID 2664 wrote to memory of 2624 2664 cmd.exe 30 PID 2664 wrote to memory of 2624 2664 cmd.exe 30 PID 2724 wrote to memory of 2696 2724 PHOTO-DEVOCHKA.exe 31 PID 2724 wrote to memory of 2696 2724 PHOTO-DEVOCHKA.exe 31 PID 2724 wrote to memory of 2696 2724 PHOTO-DEVOCHKA.exe 31 PID 2724 wrote to memory of 2696 2724 PHOTO-DEVOCHKA.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\PHOTO-DEVOCHKA.exe"C:\Users\Admin\AppData\Local\Temp\PHOTO-DEVOCHKA.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files (x86)\dus_dezodorant\mouyus\zelands.bat" "2⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\dus_dezodorant\mouyus\fifa.vbs"3⤵
- Blocklisted process makes network request
PID:2624
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\dus_dezodorant\mouyus\drochka_peredrochka.vbs"2⤵
- Drops file in Drivers directory
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5fbfaf5456d9016723c58958bbb6fcb99
SHA138d0c30b1d89f76a0471f528d6f3536061661a9b
SHA25622dcf67869a40499096986790585adef290eb556c85077ac1b5a9f5d2f0ef17d
SHA512537c9b09a96b107cf26a1a2b5aa8a513fed2632b3fdaf932d44fa63b78a1d91bd78cce7c5d7794025785c79091171a52546bb8f42f927cb1072f45873a32f2d6
-
Filesize
316B
MD59a6686649e0ccb189c6122695cb7acb3
SHA1925042488d9b06013ee5c1c8372a7980d335fab3
SHA256f8bcebb93f79463e73675bb1f611debda612e5d48237092aed4604f1da837e69
SHA512173b08167eff99101732f6b08f7111e1d6c1c998bc9794a93530857cf49183bd651340a592360c2a75b259ee83118b63c25732f01342bb5ada96467dc2e4eed6
-
Filesize
39B
MD58cdff5761878e3cf771aea2aa10c1a4e
SHA18f7c0e2f1642ae768f3f2f9a45992a1f57c26aba
SHA256c0c37efa00039b77e1b72d650ef0622c65db937771617ee3f0e3adf7f480360c
SHA512730c5dd152d8f7a48f5bcda68f10b7f64235938b106479b8340fc3bbe4cfde113219deef03ca7726bcd7c9dfbcd12e4f53c631b20a77a51644ae1c1bc10e0ab4
-
Filesize
27B
MD5213c0742081a9007c9093a01760f9f8c
SHA1df53bb518c732df777b5ce19fc7c02dcb2f9d81b
SHA2569681429a2b00c27fe6cb0453f255024813944a7cd460d18797e3c35e81c53d69
SHA51255182c2e353a0027f585535a537b9c309c3bf57f47da54a16e0c415ed6633b725bf40e40a664b1071575feeb7e589d775983516728ec3e51e87a0a29010c4eb9
-
Filesize
3KB
MD525a0b02e83ef7cc0e50772e9ca8fdbe9
SHA15bf8d941645128fc22548c44d1cb9f64b0cfb360
SHA256fd0e09bfa5c5af35ed2b17b0c3a63740fcf657550fff9a397c1a1f69af246863
SHA512b15105e92adf78c304e7ccbd2a87946a08897ab10b009643348e7675806646a3159c632f5aa788ee6ca8128cb8f76a3d77aaa49fe6e4d9ee17748b35166562bd
-
Filesize
1KB
MD544ccd2e0f82c735fbef30c341d6bfc10
SHA18cc305f7f8fff401380175ae0cc7d0df99b83373
SHA256d29b19381fbf3494195232c63a36e6a9d38de4e2db3e80ae3f007a36e9674db3
SHA5128627b9c13415f5d9c917692281f2a33aa4286f0a50b0d08933ca663cd6cc12fb17256a2270ff283dd497661001b6c06f3d16e889215821659fa24ede367dfe07